Commit 390c642e authored by Gao Xiang's avatar Gao Xiang Committed by Greg Kroah-Hartman

staging: erofs: fix integer overflow on 32-bit platform

This patch fixes integer overflow on multiplication
of 32-bit `lcn' in z_erofs_map_blocks_iter.
Signed-off-by: default avatarGao Xiang <gaoxiang25@huawei.com>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent df1e3f1f
...@@ -1513,7 +1513,7 @@ static erofs_off_t vle_get_logical_extent_head( ...@@ -1513,7 +1513,7 @@ static erofs_off_t vle_get_logical_extent_head(
*flags ^= EROFS_MAP_ZIPPED; *flags ^= EROFS_MAP_ZIPPED;
case Z_EROFS_VLE_CLUSTER_TYPE_HEAD: case Z_EROFS_VLE_CLUSTER_TYPE_HEAD:
/* clustersize should be a power of two */ /* clustersize should be a power of two */
ofs = ((unsigned long long)lcn << clusterbits) + ofs = ((u64)lcn << clusterbits) +
(le16_to_cpu(di->di_clusterofs) & (clustersize - 1)); (le16_to_cpu(di->di_clusterofs) & (clustersize - 1));
*pcn = le32_to_cpu(di->di_u.blkaddr); *pcn = le32_to_cpu(di->di_u.blkaddr);
break; break;
...@@ -1595,7 +1595,7 @@ int z_erofs_map_blocks_iter(struct inode *inode, ...@@ -1595,7 +1595,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
/* by default, compressed */ /* by default, compressed */
map->m_flags |= EROFS_MAP_ZIPPED; map->m_flags |= EROFS_MAP_ZIPPED;
end = (u64)(lcn + 1) * clustersize; end = ((u64)lcn + 1) * clustersize;
cluster_type = vle_cluster_type(di); cluster_type = vle_cluster_type(di);
...@@ -1611,7 +1611,7 @@ int z_erofs_map_blocks_iter(struct inode *inode, ...@@ -1611,7 +1611,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
} }
if (ofs_rem > logical_cluster_ofs) { if (ofs_rem > logical_cluster_ofs) {
ofs = lcn * clustersize | logical_cluster_ofs; ofs = (u64)lcn * clustersize | logical_cluster_ofs;
pcn = le32_to_cpu(di->di_u.blkaddr); pcn = le32_to_cpu(di->di_u.blkaddr);
break; break;
} }
...@@ -1623,7 +1623,7 @@ int z_erofs_map_blocks_iter(struct inode *inode, ...@@ -1623,7 +1623,7 @@ int z_erofs_map_blocks_iter(struct inode *inode,
err = -EIO; err = -EIO;
goto unmap_out; goto unmap_out;
} }
end = (lcn-- * clustersize) | logical_cluster_ofs; end = ((u64)lcn-- * clustersize) | logical_cluster_ofs;
/* fallthrough */ /* fallthrough */
case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD: case Z_EROFS_VLE_CLUSTER_TYPE_NONHEAD:
/* get the correspoinding first chunk */ /* get the correspoinding first chunk */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment